When the -A option is used to explicitly specify the sequence of mallocs and frees, the vm-freespace/malloc.py simulation script prints the address of the header that precedes each allocated block, rather than the address of the allocated block. I think that the string printed here should insert ptr + options.headerSize instead of just ptr, like this string that is printed when the malloc/free sequence is randomised.